[cpp-sp] branch main updated: Adjust and harmonize TLS options.
Codeberg
noreply at shibboleth.net
Mon Aug 24 18:23:54 UTC 2026
This is an automated email from the git hooks/post-receive script.
codeberg pushed a commit to branch main
in repository cpp-sp.
View the commit online:
https://codeberg.org/Shibboleth/cpp-sp/commit/83e6d1fce3ba87a0f05f7303ac3c46172be79bf9
The following commit(s) were added to refs/heads/main by this push:
new 83e6d1fc Adjust and harmonize TLS options.
83e6d1fc is described below
commit 83e6d1fce3ba87a0f05f7303ac3c46172be79bf9
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Mon Aug 24 14:23:44 2026 -0400
Adjust and harmonize TLS options.
---
.../remoting/impl/AbstractHTTPRemotingService.cpp | 23 ++++++++++++++++------
shibsp/remoting/impl/AbstractHTTPRemotingService.h | 10 +++++++---
shibsp/remoting/impl/CurlHTTPRemotingService.cpp | 21 ++++++++++++++++----
shibsp/remoting/impl/WinHTTPRemotingService.cpp | 22 +++++++++------------
4 files changed, 50 insertions(+), 26 deletions(-)
diff --git a/shibsp/remoting/impl/AbstractHTTPRemotingService.cpp b/shibsp/remoting/impl/AbstractHTTPRemotingService.cpp
index b2be4ccc..e0be4e08 100644
--- a/shibsp/remoting/impl/AbstractHTTPRemotingService.cpp
+++ b/shibsp/remoting/impl/AbstractHTTPRemotingService.cpp
@@ -56,8 +56,12 @@ AbstractHTTPRemotingService::AbstractHTTPRemotingService(ptree& pt)
static const char REVOCATION_CHECK_PROP_NAME[] = "revocationCheck";
static const char ENABLE_IP4_PROP_NAME[] = "enableIP4";
static const char ENABLE_IP6_PROP_NAME[] = "enableIP6";
- static const char CIPHER_LIST_PROP_NAME[] = "tlsCipherList";
+
+ static const char DISABLE_TLS12_PROP_NAME[] = "enableTLS12";
+ static const char DISABLE_TLS13_PROP_NAME[] = "enableTLS13";
+ static const char TLS12_CIPHER_LIST_PROP_NAME[] = "tls12CipherList";
static const char TLS13_CIPHER_LIST_PROP_NAME[] = "tls13CipherList";
+
static const char CHUNKED_PROP_NAME[] = "chunkedEncoding";
static const char TRACE_FILE_PROP_NAME[] = "traceFileBase";
@@ -73,6 +77,8 @@ AbstractHTTPRemotingService::AbstractHTTPRemotingService(ptree& pt)
static const bool REVOCATION_CHECK_DEFAULT = false;
static const bool ENABLE_IP4_PROP_DEFAULT = true;
static const bool ENABLE_IP6_PROP_DEFAULT = true;
+ static const bool DISABLE_TLS12_PROP_DEFAULT = false;
+ static const bool DISABLE_TLS13_PROP_DEFAULT = false;
static const char CIPHER_LIST_PROP_DEFAULT[] = "";
static bool CHUNKED_PROP_DEFAULT = true;
static const char TRACE_FILE_PROP_DEFAULT[] = "";
@@ -91,7 +97,9 @@ AbstractHTTPRemotingService::AbstractHTTPRemotingService(ptree& pt)
m_enableIP4 = props.getBool(ENABLE_IP4_PROP_NAME, ENABLE_IP4_PROP_DEFAULT);
m_enableIP6 = props.getBool(ENABLE_IP6_PROP_NAME, ENABLE_IP6_PROP_DEFAULT);
m_chunked = props.getBool(CHUNKED_PROP_NAME, CHUNKED_PROP_DEFAULT);
- m_ciphers = props.getString(CIPHER_LIST_PROP_NAME, CIPHER_LIST_PROP_DEFAULT);
+ m_disableTLS12 = props.getBool(DISABLE_TLS12_PROP_NAME, DISABLE_TLS12_PROP_DEFAULT);
+ m_disableTLS13 = props.getBool(DISABLE_TLS13_PROP_NAME, DISABLE_TLS13_PROP_DEFAULT);
+ m_tls12Ciphers = props.getString(TLS12_CIPHER_LIST_PROP_NAME, CIPHER_LIST_PROP_DEFAULT);
m_tls13Ciphers = props.getString(TLS13_CIPHER_LIST_PROP_NAME, CIPHER_LIST_PROP_DEFAULT);
m_traceFileBase = props.getString(TRACE_FILE_PROP_NAME, TRACE_FILE_PROP_DEFAULT);
@@ -99,6 +107,10 @@ AbstractHTTPRemotingService::AbstractHTTPRemotingService(ptree& pt)
throw ConfigurationException("One of IP4 or IP6 must be enabled.");
}
+ if (m_disableTLS12 && m_disableTLS13) {
+ throw ConfigurationException("One of TLS 1.2 or TLS 1.3 must be enabled.");
+ }
+
if (m_authMethod != agent_auth_none) {
m_secretSource.reset(AgentConfig::getConfig().SecretSourceManager.newPlugin(
props.getString(SECRET_SOURCE_TYPE_PROP_NAME, SECRET_SOURCE_TYPE_PROP_DEFAULT), pt, false)
@@ -189,7 +201,6 @@ const char* AbstractHTTPRemotingService::getAgentID() const
return m_agentID.c_str();
}
-
void AbstractHTTPRemotingService::setUserAgent(const char* ua)
{
m_userAgent = ua ? ua : "";
@@ -245,11 +256,11 @@ bool AbstractHTTPRemotingService::isChunked() const {
return m_chunked;
}
-const string& AbstractHTTPRemotingService::getCiphers() const {
- return m_ciphers;
+const string& AbstractHTTPRemotingService::getTLS12Ciphers() const {
+ return m_tls12Ciphers;
}
-const string& AbstractHTTPRemotingService::getTls13Ciphers() const {
+const string& AbstractHTTPRemotingService::getTLS13Ciphers() const {
return m_tls13Ciphers;
}
diff --git a/shibsp/remoting/impl/AbstractHTTPRemotingService.h b/shibsp/remoting/impl/AbstractHTTPRemotingService.h
index 1ebd2171..cb0cee59 100644
--- a/shibsp/remoting/impl/AbstractHTTPRemotingService.h
+++ b/shibsp/remoting/impl/AbstractHTTPRemotingService.h
@@ -83,8 +83,10 @@ namespace shibsp {
bool isEnableIP4() const;
bool isEnableIP6() const;
bool isChunked() const;
- const std::string& getCiphers() const;
- const std::string& getTls13Ciphers() const;
+ bool isDisableTLS12() const;
+ bool isDisableTLS13() const;
+ const std::string& getTLS12Ciphers() const;
+ const std::string& getTLS13Ciphers() const;
const std::string& getTraceFileBase() const;
protected:
@@ -107,7 +109,9 @@ namespace shibsp {
bool m_enableIP4;
bool m_enableIP6;
bool m_chunked;
- std::string m_ciphers;
+ bool m_disableTLS12;
+ bool m_disableTLS13;
+ std::string m_tls12Ciphers;
std::string m_tls13Ciphers;
std::string m_traceFileBase;
/** Shared lock for guarding auth cache value. */
diff --git a/shibsp/remoting/impl/CurlHTTPRemotingService.cpp b/shibsp/remoting/impl/CurlHTTPRemotingService.cpp
index 40393e65..aa8090c8 100644
--- a/shibsp/remoting/impl/CurlHTTPRemotingService.cpp
+++ b/shibsp/remoting/impl/CurlHTTPRemotingService.cpp
@@ -258,12 +258,25 @@ CURL* CurlHTTPRemotingService::checkout() const
SHIB_CURL_SET(CURLOPT_SSL_VERIFYPEER, 1);
SHIB_CURL_SET(CURLOPT_SSL_VERIFYHOST, 2);
- if (!getCiphers().empty()) {
- SHIB_CURL_SET(CURLOPT_SSL_CIPHER_LIST, getCiphers().c_str());
+ if (!getTLS12Ciphers().empty()) {
+ SHIB_CURL_SET(CURLOPT_SSL_CIPHER_LIST, getTLS12Ciphers().c_str());
}
- if (!getTls13Ciphers().empty()) {
- SHIB_CURL_SET(CURLOPT_TLS13_CIPHERS, getTls13Ciphers().c_str());
+ if (!getTLS13Ciphers().empty()) {
+ SHIB_CURL_SET(CURLOPT_TLS13_CIPHERS, getTLS13Ciphers().c_str());
}
+
+ if (isDisableTLS12()) {
+ // Implies from base class that 1.3 is enabled...
+ SHIB_CURL_SET(CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_3);
+ }
+ else if (isDisableTLS13()) {
+ // Implies from above, and base class, that 1.2 is enabled...
+ SHIB_CURL_SET(CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_TLSv1_2);
+ }
+ else {
+ // Use libcurl's defaults.
+ }
+
if (getCAFile()) {
SHIB_CURL_SET(CURLOPT_CAINFO, getCAFile());
}
diff --git a/shibsp/remoting/impl/WinHTTPRemotingService.cpp b/shibsp/remoting/impl/WinHTTPRemotingService.cpp
index 5eebe4df..d88d7345 100644
--- a/shibsp/remoting/impl/WinHTTPRemotingService.cpp
+++ b/shibsp/remoting/impl/WinHTTPRemotingService.cpp
@@ -79,7 +79,7 @@ namespace {
HCERTCHAINENGINE m_caChainEngine;
HCERTSTORE m_caStore;
void setupCaChecking();
- set<string> m_cipherSet;
+ set<string> m_tls12CipherSet;
set<string> m_tls13CipherSet;
string getCertName(PCCERT_CONTEXT certContext) const;
};
@@ -246,22 +246,16 @@ WinHTTPRemotingService::WinHTTPRemotingService(ptree& pt)
AbstractHTTPRemotingService(pt),
m_log(Category::getInstance(SHIBSP_LOGCAT ".RemotingService")),
m_secure(false), m_caChainEngine(nullptr), m_caStore(nullptr),
- m_init(false), m_cipherSet(), m_tls13CipherSet()
+ m_init(false)
{
if (getUserAgent() == nullptr) {
string useragent = string(PACKAGE_NAME) + '/' + PACKAGE_VERSION + '/' + "WINHTTP";
setUserAgent(useragent.c_str());
}
- static const char TLS_12_PROP_NAME[] = "enableTls12";
- static const char TLS_13_PROP_NAME[] = "enableTls13";
-
BoostPropertySet props;
props.load(pt);
- bool enableTls12 = props.getBool(TLS_12_PROP_NAME, true);
- bool enableTls13 = props.getBool(TLS_13_PROP_NAME, true);
-
m_username = utf8ToUtf16(getAgentID());
switch (getAuthMethod()) {
case agent_auth_basic: m_authScheme = WINHTTP_AUTH_SCHEME_BASIC; break;
@@ -280,8 +274,8 @@ WinHTTPRemotingService::WinHTTPRemotingService(ptree& pt)
throw runtime_error("WinHHHTP failed to initialize service (WinHttpOpen)");
}
- split_to_container(m_cipherSet, getCiphers().c_str());
- split_to_container(m_tls13CipherSet, getTls13Ciphers().c_str());
+ split_to_container(m_tls12CipherSet, getTLS12Ciphers().c_str());
+ split_to_container(m_tls13CipherSet, getTLS13Ciphers().c_str());
//
// Set up our CaPath environment
//
@@ -343,10 +337,12 @@ WinHTTPRemotingService::WinHTTPRemotingService(ptree& pt)
}
flags = 0;
- if (enableTls12)
- flags |= WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_2;
- if (enableTls13)
+ if (isDisableTLS12()) {
flags |= WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_3;
+ }
+ else if (isDisableTLS13()) {
+ flags |= WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_2;
+ }
if (flags) {
if (!WinHttpSetOption(m_session, WINHTTP_OPTION_SECURE_PROTOCOLS, &flags, sizeof(flags))) {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list